robo created PDFBOX-6253:
----------------------------
Summary: CertInformationCollector.traverseChain() can throw
ConcurrentModificationException when loading alternative issuer certificate
Key: PDFBOX-6253
URL: https://issues.apache.org/jira/browse/PDFBOX-6253
Project: PDFBox
Issue Type: Bug
Reporter: robo
We use digicert
([http://timestamp.digicert.com|http://timestamp.digicert.com/]) as TSA for an
integration. This exception popped suddenly up during testing:
{code:java}
java.util.ConcurrentModificationException
at java.base/java.util.HashMap$HashIterator.nextNode(HashMap.java:1605)
at java.base/java.util.HashMap$KeyIterator.next(HashMap.java:1628)
at
...CertInformationCollector.traverseChain(CertInformationCollector.java:244)
at
...CertInformationCollector.getAlternativeIssuerCertificate(CertInformationCollector.java:304)
at
...CertInformationCollector.traverseChain(CertInformationCollector.java:227)
{code}
The problem is here:
{code:java}
for (X509Certificate issuer : certificateSet) {code}
During that iteration, traverseChain() is called recursively. The recursive
call may invoke getAlternativeIssuerCertificate(), which modifies the same set.
This, again, may lead to an ConcurrentModificationException.
For the time being, I fixed it with:
{code:java}
for (X509Certificate issuer : new HashSet<>(certificateSet)){code}
This looks semantically correct, although there might be edge cases, where this
approach could miss an issuer discovered during recursion? Perhaps issuer
detection and recursive chain traversal could be somehow separated instead,
avoiding dynamic modification of the set?
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
